go-pki-cmp¶
go-pki-cmp is a Go library for the Certificate Management Protocol (CMP). It has four packages:
pkicmpencodes, parses, protects and verifies CMP and CRMF messagesclientenrolls, updates and revokes certificates and asks a CA for informationserverserves the same operations to CMP clients as anhttp.Handlerin front of your CAcmsencrypts and decrypts the CMS EnvelopedData and EncryptedValue that proof of possession by decryption needs
The server handles the protocol: transport, message protection, transactions, polling and certificate confirmation. Your application supplies issuance, credential lookup and authorization policy through Go interfaces. cmp-issuer, a cert-manager external issuer, is built on this library. So is certrally, a command line client for CMP, EST and SCEP certificate enrollment.
Certificates can carry post-quantum ML-DSA, SLH-DSA or composite ML-DSA keys and all of them can sign CMP messages. ML-KEM keys are certified through proof of possession by decryption. The support matrix lists what is covered.
Install¶
go get github.com/misiektoja/go-pki-cmp
The module needs Go 1.27.3 or newer. Releases up to v0.3.2 use the module path
github.com/misiektoja/go-pkicmp-ng.
Start here¶
Getting started runs the example CA and client from the repository. The client enrolls with a shared secret, updates its key and revokes the result. The page then names each piece you replace in your own client or server.
Where to go next¶
| I want to | Page |
|---|---|
| Know which RFCs, messages, algorithms and keys are covered | Support matrix |
| Understand how the packages and my code fit together | Architecture |
| Request certificates from a CA | Enrollment |
| Decide which CA certificates and responses the client trusts | Response verification |
| Revoke a certificate | Revocation (client) |
| Fetch CA certificates, root updates, templates or CRLs | Support messages (client) |
| Certify an ML-KEM or encryption-only key | Keys that cannot sign (client) |
| Have the CA generate my key pair | Keys the CA generates |
| Forward and approve requests as a registration authority | Acting as a registration authority |
| Put a CMP front end on my CA | Implementing a CA |
| Authenticate devices by shared secret or certificate | Authentication |
| Accept clients that break RFC 9483 rules | Policy and client compatibility |
| Hold requests for an operator's approval | Delayed issuance and confirmation |
| Generate key pairs for devices that cannot | Keys the server generates |
| Accept requests forwarded by a registration authority | Registration authorities |
| Run several replicas or survive a restart | Transactions and recovery |
| Build or verify CMP messages myself | Messages and protection |
| Look up an option and its default | Client options and Server options |
| See which CMP implementations were tested | Tested implementations |
| Fix a refused request | Troubleshooting |
| Understand what is not implemented | Known limitations |
Design and security¶
- Security model - what the library checks and what remains with your application
- Compatibility policy - what may change before v1.0.0 and how
- Package documentation - every exported type and option
Contributing¶
- Development, Testing and Release process
- Source and issues: github.com/misiektoja/go-pki-cmp
Credits¶
go-pki-cmp began as a fork of tsaarni/go-pkicmp by Tero Saarni. Its package layout, ASN.1 types and client and server design come from that project. The NOTICE file records the attribution.
Support¶
SUPPORT.md routes usage questions, bug reports, feature requests and private security reports. Check Troubleshooting and collect sanitized diagnostics before posting.